dsh-ntr 0.1.6 → 0.2.0

package/lib/impl.js

@@ -1513,13 +1513,35 @@ export class PermissionLedger {
             views.push({
                 requestId: entry.requestId,
                 sessionId: entry.sessionId,
-                toolCall: entry.view.toolCall,
-                options: entry.view.options,
+                ...entry.view,
             });
         }
         return views;
     }
 }
+/**
+ * The `permission/request` frame for one ask.
+ *
+ * ONE builder for both the live broadcast and the reconnect replay, so the two
+ * can never drift: a client that reconnects must receive exactly the frame the
+ * live one carried (its conversation card filters on `dshSessionId` and shows
+ * `toolName` / `deadlineAt`, so a replay missing them would silently drop the
+ * ask).
+ */
+export function permissionRequestFrame(view) {
+    return {
+        type: 'permission/request',
+        requestId: view.requestId,
+        sessionId: view.sessionId,
+        ...(view.dshSessionId === undefined ? {} : { dshSessionId: view.dshSessionId }),
+        toolCall: view.toolCall,
+        toolName: view.toolName,
+        ...(view.reason === undefined ? {} : { reason: view.reason }),
+        options: view.options,
+        timeoutMode: view.timeoutMode,
+        ...(view.deadlineAt === undefined ? {} : { deadlineAt: view.deadlineAt }),
+    };
+}
 /**
  * Frames that re-establish a freshly connected client's view of the pending
  * permission asks: every outstanding ask re-sent as its original
@@ -1527,10 +1549,10 @@ export class PermissionLedger {
  *
  * Why a replay at all: a `permission/request` is broadcast ONCE, when the ask is
  * created. A client that connects later — page reload, second tab, stream
- * outage — never receives it, and for a ledger ask (the `/acp` RPC path, or a
- * native route that degraded) that card is the ONLY answer entry, so the ask is
- * invisible to exactly the client that needs it. OmniTerm closes the same hole
- * with `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
+ * outage — never receives it, and that card (conversation or settings ledger)
+ * is the ONLY answer entry for the ask, so the ask is invisible to exactly the
+ * client that needs it. OmniTerm closes the same hole with
+ * `PermissionManager::pending_events()` + a `PermissionsSynced` marker on
  * every WS connect.
  *
  * Why the terminator is mandatory: the replay is a snapshot, so an ask resolved
@@ -1539,13 +1561,7 @@ export class PermissionLedger {
  * `respond` would answer `unknown_request`.
  */
 export function permissionReplayFrames(pending) {
-    const requests = pending.map(p => ({
-        type: 'permission/request',
-        requestId: p.requestId,
-        sessionId: p.sessionId,
-        toolCall: p.toolCall,
-        options: p.options,
-    }));
+    const requests = pending.map(permissionRequestFrame);
     return [...requests, { type: 'permission/synced', requestIds: pending.map(p => p.requestId) }];
 }
 function ok(value) {
@@ -1579,12 +1595,7 @@ export async function dispatchRpc(manager, endpoint, payload) {
     try {
         switch (endpoint) {
             case 'agents/list':
-                // `approvalRouted` is a capability report, not a command: the browser
-                // uses it to decide whether the settings panel still owns approvals.
-                return ok({
-                    agents: manager.agentViews(),
-                    approvalRouted: manager.approvalRouting?.() ?? false,
-                });
+                return ok({ agents: manager.agentViews() });
             case 'agents/detect':
                 return ok({ agents: await (manager.detectAgents?.() ?? Promise.resolve([])) });
             case 'agent/save': {

package/lib/index.js

@@ -7,10 +7,10 @@
 import { ACP_PRESET_ID, AcpLlmAdapter, BridgeManager } from "./bridge.js";
 import { EventHub, dispatchRpc, permissionReplayFrames, sessionAgentPreset, sessionAgentPresetFromLog, validateConfig } from "./impl.js";
 export const name = 'dsh-ntr';
-// `approval` / `agents` are deliberately NOT listed here: they are optional
-// collaborators probed structurally below. A hard dependency would make the
-// whole plugin fail to load on a deployment without them (see the LLM service
-// probe, which follows the same shape).
+// Deliberately minimal: every other host service is probed structurally
+// (`ctx.get` + a late `ctx.inject`) so a deployment without one still loads
+// this plugin. ACP permission asks are answered through this plugin's own
+// ledger, so the host approval service is not a collaborator at all.
 export const inject = ['webServer', 'connection'];
 /** How many stored events the cold-read folds before giving up on scanning. */
 const COLD_READ_MAX_EVENTS = 4096;
@@ -86,43 +86,6 @@ export function apply(ctx, config) {
         // Late arrival: the registry may still be loading when this plugin applies.
         ctx.inject(['agentPresets'], () => { wirePresetRoster(); });
     }
-    /**
-     * Native approval routing: answer ACP `session/request_permission` through
-     * the host approval chain so the question takes over the chat composer
-     * (`ApprovalPanel`) instead of the settings panel.
-     *
-     * `approval.request` needs the live agent object (its session carries the
-     * audit pair, and the ask must land inside an open turn) and the chat
-     * session id our adapter already knows. Any missing piece — service absent,
-     * unknown session, a rejecting service — degrades to `'unavailable'`, which
-     * sends the ask back to the ledger/panel path rather than losing it.
-     */
-    const wireApproval = () => {
-        const approval = (typeof ctx.get === 'function' ? ctx.get('approval') : ctx.approval);
-        const agents = (typeof ctx.get === 'function' ? ctx.get('agents') : ctx.agents);
-        if (approval === undefined || agents === undefined)
-            return;
-        manager.setApprovalRequester(async ({ dshSessionId, toolName, reason, callId, signal }) => {
-            if (dshSessionId === undefined)
-                return 'unavailable';
-            const agent = agents.get(dshSessionId);
-            if (agent === undefined)
-                return 'unavailable';
-            try {
-                return await approval.request({
-                    agent,
-                    toolName,
-                    ...(reason === undefined ? {} : { reason }),
-                    ...(callId === undefined ? {} : { callId }),
-                    ...(signal === undefined ? {} : { signal }),
-                });
-            }
-            catch {
-                // Never propagate: a failed ask must fall back, not break the turn.
-                return 'unavailable';
-            }
-        });
-    };
     /**
      * Workspace routing: the sidebar's selected workspace IS the chat session's
      * workspace, so the agent's session and its process both run there (see
@@ -216,11 +179,10 @@ export function apply(ctx, config) {
             return undefined;
         }
     };
-    wireApproval();
     wireWorkspace();
     if (typeof ctx.inject === 'function') {
-        // Late arrival for the workspace collaborators; kept separate from the
-        // approval probe so a deployment missing one service still wires the other.
+        // Late arrival for the workspace collaborators: a deployment missing one
+        // service must not fail this plugin's activation.
         ctx.inject(['sandboxPolicy', 'sessions'], () => {
             wireWorkspace();
         });
@@ -233,13 +195,6 @@ export function apply(ctx, config) {
             wireAcpMode();
         });
     }
-    if (typeof ctx.inject === 'function') {
-        // Late arrival: both services may still be loading when this plugin
-        // applies (profile order is not ours to control).
-        ctx.inject(['approval', 'agents'], () => {
-            wireApproval();
-        });
-    }
     const registerLlm = (llmHandle) => {
         ctx.effect(() => {
             // The route exists so the host's driver can reach this adapter at all:

package/lib/types/bridge.d.ts

@@ -39,9 +39,9 @@ interface LiveSession {
     released: boolean;
     /**
      * Owning DSH chat session id, when the session was opened through the LLM
-     * adapter (`AcpLlmAdapter`). `ctx.agents.get()` needs it to name the agent
-     * whose open turn carries the native approval question; sessions started
-     * over the `/acp` RPC have no chat session and stay on the ledger path.
+     * adapter (`AcpLlmAdapter`). It is what the conversation's permission card
+     * filters on (`permission/request.dshSessionId`); sessions started over the
+     * `/acp` RPC have no chat session, so their asks stay on the settings panel.
      */
     dshSessionId?: string;
     /**
@@ -98,21 +98,24 @@ export interface BridgeTuning {
     /**
      * How long a permission ask may sit unanswered before the deadline fires.
      *
-     * ONE window for both routes. An ask can be asked in the conversation (the
-     * composer takeover) or in the settings panel's ledger (no approval service,
-     * or no chat identity to route into) — but both ask the same question, "is
-     * anyone there?", so both get the same answer. Two windows made the settings
-     * card look like two unrelated knobs.
-     *
-     * `0` means 一直等 — no deadline at all. What happens when it fires is
-     * {@link BridgeTuning.permissionTimeoutMode}'s business, never this knob's.
-     *
-     * The deadline is what keeps a turn from hanging on a question nobody can
-     * see: a routed ask shows no card and broadcasts no frame, so a host that
-     * takes the question and never renders it would otherwise leave the turn
-     * hanging forever. Past the deadline the ask is settled IN PLACE — it is not
-     * handed anywhere else. A human who was still deciding finds the ask REFUSED
-     * (or auto-answered, in `auto` mode), not relocated.
+     * ONE window for every ask. Every ask is broadcast as `permission/request`
+     * and answered from the conversation's dock card; an `/acp`-RPC ask has no
+     * conversation, so the settings page mirrors the same ask as its answer
+     * entry. One question, one window: "is anyone there?" gets the same answer
+     * wherever the card is rendered, and two numbers made the settings card look
+     * like two unrelated knobs.
+     *
+     * `0` means 不等待, not "wait forever": `auto` settles the ask on arrival,
+     * `abort` floors the window to the shortest real wait (refusing every ask on
+     * arrival is a brick wall, not a timeout), and `wait` ignores the window
+     * entirely.
+     *
+     * The deadline is what keeps a turn from hanging on a question nobody
+     * answers: the card stays visible, but an unattended session would otherwise
+     * wait indefinitely. Past the deadline the ask is settled IN PLACE — never
+     * relocated: `abort` refuses it, `auto` answers it with the option the
+     * agent's own kinds imply (broadest grant first), and `wait` never expires
+     * it at all.
      *
      * Default 300000 ms. OmniTerm's equivalent is its reaper's permission-timeout
      * threshold (30 min default, 30 s steps, hot-updatable).
@@ -167,47 +170,6 @@ export interface BridgeTuning {
      */
     probeIdleTimeoutMs?: number;
 }
-/** One native approval question, as the host approval service defines it. */
-export interface ApprovalRequestContext {
-    /** DSH chat session that owns the open turn the question is asked in. */
-    dshSessionId?: string;
-    agentId: string;
-    /** Human-facing identity of the operation awaiting a decision. */
-    toolName: string;
-    reason?: string;
-    /** The ACP tool call this ask belongs to; the host card attaches its detail to it. */
-    callId?: string;
-    signal?: AbortSignal;
-}
-/** Outcome vocabulary of the host approval chain (`'unavailable'` = no answerer). */
-export type ApprovalOutcome = 'allowed-once' | 'rejected' | 'cancelled' | 'unavailable';
-/**
- * Why one permission ask rides the settings-panel ledger instead of the native
- * approval chain, recorded when the ask is broadcast.
- *
- * `no-requester` and `no-chat-session` are the DESIGNED ledger paths: a host
- * without the approval service, and an `/acp`-RPC session that has no chat
- * turn to route into. `unavailable` is a DEGRADATION — the service is wired
- * and this ask still failed, so the conversation the user is looking at will
- * never show the question. The reason decides the chat line's wording (see
- * `BridgeManager.streamPrompt`); the deadline and the mode decide what
- * happens if nobody answers ({@link AgentBridge.handlePermissionRequest}).
- */
-export type LedgerFallbackReason = 'no-requester' | 'no-chat-session' | 'unavailable';
-/** One recorded ledger fallback: why the ask is here, and the deadline armed for it. */
-export interface LedgerFallback {
-    reason: LedgerFallbackReason;
-    /** Effective deadline in ms; `0` = no timer (wait for the human). */
-    timeoutMs: number;
-    /** What the deadline does when it fires. */
-    mode: PermissionTimeoutMode;
-}
-/**
- * Asks the host approval service (`ctx.approval`) for one decision. Never
- * throws: any failure is reported as `'unavailable'` so the caller can fall
- * back to the settings-panel ledger.
- */
-export type ApprovalRequester = (request: ApprovalRequestContext) => Promise<ApprovalOutcome>;
 /**
  * Resolves the workspace root of one chat session (`dshSessionId` = DSH session
  * id) — the sidebar's selected workspace, which the host's sandbox policy keeps
@@ -244,13 +206,8 @@ export declare class AgentBridge {
     /** Observes `availableCommands` from any real session so the agent's slash menu survives its sessions. */
     private readonly onCommands?;
     /**
-     * Resolved per ask (not captured) so a requester wired after this bridge
-     * was built still applies. Absent → every ask rides the ledger.
-     */
-    private readonly approvalRequester?;
-    /**
-     * Resolved per turn, like {@link approvalRequester}: the host entry may
-     * wire the access-mode mapping after this bridge was built.
+     * Resolved per turn: the host entry may wire the workspace reader after
+     * this bridge was built.
      */
     private readonly sessionWorkspace?;
     state: BridgeState;
@@ -267,15 +224,6 @@ export declare class AgentBridge {
     /** Inflight `session/load` resumes, shared so concurrent prompts don't double-resume. */
     private readonly resuming;
     readonly permissions: PermissionLedger;
-    /**
-     * Why each outstanding ledger ask is on the ledger, keyed by request id and
-     * recorded before the `permission/request` broadcast (the hub is
-     * synchronous, so a subscriber can read it the moment the frame goes out).
-     * Entries live exactly as long as the ask: the ledger's resolve callback
-     * deletes them, and every terminal path (answer, timeout, session close,
-     * process death) resolves through it.
-     */
-    private readonly ledgerFallbacks;
     private readonly startupTimeoutMs;
     /**
      * The ONE approval deadline, and the mode it settles with. Neither is
@@ -335,13 +283,8 @@ export declare class AgentBridge {
     /** Observes `availableCommands` from any real session so the agent's slash menu survives its sessions. */
     onCommands?: ((agentId: string, commands: NonNullable<SessionView["availableCommands"]>) => void) | undefined, tuning?: BridgeTuning, 
     /**
-     * Resolved per ask (not captured) so a requester wired after this bridge
-     * was built still applies. Absent → every ask rides the ledger.
-     */
-    approvalRequester?: (() => ApprovalRequester | undefined) | undefined, 
-    /**
-     * Resolved per turn, like {@link approvalRequester}: the host entry may
-     * wire the access-mode mapping after this bridge was built.
+     * Resolved per turn: the host entry may wire the workspace reader after
+     * this bridge was built.
      */
     sessionWorkspace?: (() => SessionWorkspaceResolver | undefined) | undefined);
     /**
@@ -571,56 +514,36 @@ export declare class AgentBridge {
     stop(reason?: 'closed' | 'agent-stopped' | 'agent-died'): Promise<void>;
     private killChild;
     /**
-     * Answer one ACP permission ask. Every ask reaches a human: the native
-     * approval chain first (answered in the chat composer), the settings-panel
-     * ledger otherwise.
+     * Answer one ACP permission ask.
+     *
+     * EVERY ask is answered by a human through the plugin's own ledger. The
+     * host's approval chain is deliberately not involved: it could accept an ask
+     * and render nothing, leaving the turn hanging behind something invisible
+     * with no deadline (issue #2). The ledger broadcasts `permission/request`,
+     * the browser renders the answerable card, and `permission/respond` settles
+     * it.
+     *
+     * The host answers on its own only when a deadline expires: `abort` refuses,
+     * `auto` picks the option the agent's own kinds imply, `wait` never expires.
+     * The ACP request's own `signal` (the agent withdrawing the ask, or the
+     * connection dying) settles the same entry cancelled, so a withdrawn ask can
+     * never leave a stale card behind.
      */
     private handlePermissionRequest;
     /**
-     * Why one ledger ask is on the ledger, as recorded by
-     * {@link handlePermissionRequest}. The manager's `streamPrompt` reads it to
-     * word the chat line by the path the ask took; `undefined` once the ask is
-     * answered, timed out, or settled.
+     * Announce and compute one ask's expiry. Shared by the 不等待 arrival path
+     * and the ledger deadline, so an expiry can never broadcast two notices or
+     * skip the `permission/expired` line: once the card is gone that frame is
+     * the conversation's only trace of what happened to the question.
      */
-    ledgerFallbackOf(requestId: string): LedgerFallback | undefined;
+    private announceExpiredAsk;
     /**
-     * Ask the host approval service for this permission (`ctx.approval` → the
-     * browser's composer takeover). Only sessions bound to a DSH chat session
-     * qualify: the service appends its audit pair to that session inside an
-     * open turn, so a session started over `/acp` (no chat turn) cannot be
-     * routed and must stay on the ledger path.
-     *
-     * The ask is raced against {@link BridgeTuning.permissionTimeoutMs}. A
-     * routed ask has exactly one answer entry — the composer takeover — and no
-     * broadcast at all, so a host that takes the question and never renders it
-     * would leave the turn hanging behind something invisible. Past the deadline
-     * the ask is settled RIGHT THERE, by
-     * {@link BridgeTuning.permissionTimeoutMode}: refused (`abort`), answered
-     * with the option the agent's own kinds imply (`auto`), or never expiring
-     * at all (`wait`).
-     *
-     * It is NOT handed somewhere else. An earlier revision withdrew the ask and
-     * re-asked it on the settings ledger, which made the question travel to a
-     * page the user was not looking at — and then cancelled it there a few
-     * minutes later anyway. A deadline now ends the ask where it was asked.
-     *
-     * @returns the agent-facing response, or the reason the ask must fall back
-     * to the ledger (see {@link LedgerFallbackReason}).
-     */
-    private askNativeApproval;
-    /**
-     * Settle an ask whose deadline fired, WHERE IT WAS ASKED.
-     *
-     * `abort` refuses it — the operation does not happen and the agent carries
-     * on with that answer. `auto` answers it with the option the agent's own
-     * kinds imply ({@link pickAutoOption}) so the agent CONTINUES; it says which
-     * option it picked, because an unattended approval nobody looked at has to
-     * be visible afterwards. A mode that cannot pick an option (no options, or
-     * none with a usable id) degrades to `abort`: refusing is safer than
-     * guessing, and hanging is worse than either.
-     *
-     * The `permission/resolved` frame keeps the event stream symmetric with the
-     * ledger path, so the browser drops any card it may hold for this session.
+     * Settle the 不等待 (`auto` + zero window) ask on arrival: no ledger entry
+     * and no card — nothing asks a human, so there is nothing to show. `auto`
+     * answers with the option the agent's own kinds imply ({@link pickAutoOption})
+     * and the agent CONTINUES. A mode that cannot pick an option (no options, or
+     * none with a usable id) degrades to refusing: safer than guessing, and
+     * hanging is worse than either.
      */
     private settleExpiredAsk;
     private settlePermissions;
@@ -639,7 +562,7 @@ export declare class AgentBridge {
      * cannot reach into the agent's own process, so a second gate here would only
      * be a fiction in front of a tool that can write without asking us at all.
      * What the agent chooses to ask about goes to the human unchanged
-     * (`askNativeApproval`). See docs/acp-convergence.md §2.3.
+     * (`handlePermissionRequest`). See docs/acp-convergence.md §2.3.
      */
     private handleFsWrite;
     private guardFsPath;
@@ -661,12 +584,11 @@ export declare class AgentBridge {
  */
 export declare function permissionToolName(toolCall: unknown): string;
 /**
- * One line saying WHAT the native approval card is about.
+ * One line saying WHAT the permission ask is about.
  *
- * WHY: the host renders `reason ?? "工具 <name> 请求越权执行"`. Without a
- * reason the human only sees the tool's NAME ("Bash") and cannot judge the
- * request; the ACP tool call already declares the missing half — its title and
- * (for execute/edit tools) a short scalar in `rawInput`. Only ONE declared
+ * WHY: without it the human only sees the tool's NAME ("Bash") and cannot
+ * judge the request; the ACP tool call already declares the missing half — its
+ * title and (for execute/edit tools) a short scalar in `rawInput`. Only ONE declared
  * string is used, never a serialized object or a whole file, and the line is
  * capped so a pathological input cannot fill the card or the audit log.
  */
@@ -928,7 +850,6 @@ type TurnSettle = {
 declare class TurnStreamController {
     private readonly manager;
     private readonly hub;
-    private readonly bridge;
     readonly session: LiveSession;
     readonly turnId: string;
     /** Releases the agent-side turn slot (the `beginTurn` settler; idempotent). */
@@ -944,7 +865,7 @@ declare class TurnStreamController {
     private readonly pendingProse;
     sawVisibleBlock: boolean;
     private cursorSeq;
-    constructor(manager: BridgeManager, hub: EventHub, bridge: AgentBridge, session: LiveSession, turnId: string, 
+    constructor(manager: BridgeManager, hub: EventHub, session: LiveSession, turnId: string, 
     /** Releases the agent-side turn slot (the `beginTurn` settler; idempotent). */
     endTurn: () => void, rollbackFirstTurn: (session: LiveSession) => void);
     private readonly unsubscribe;
@@ -1100,20 +1021,10 @@ export declare class BridgeManager {
     probeModelsOnBoot?: boolean, tuning?: BridgeTuning);
     private makeBridge;
     /**
-     * Route ACP permission asks through the host approval service (answered in
-     * the chat composer). Absent → every ask stays on the settings-panel ledger.
-     * Setting it also flips {@link approvalRouting}, which the browser reads to
-     * stop rendering the settings-panel permission card.
-     */
-    setApprovalRequester(requester?: ApprovalRequester): void;
-    /** True when permission asks go to native approval instead of the settings panel. */
-    approvalRouting(): boolean;
-    /**
-     * Every outstanding ledger ask, across all agents, with the view the browser
-     * was shown it — the source of the reconnect replay (see
-     * `permissionReplayFrames`). Asks on the native route are deliberately
-     * absent: they broadcast nothing and their answer entry is the composer
-     * takeover the client already holds.
+     * Every outstanding ask, across all agents, with the view the browser was
+     * shown it — the source of the reconnect replay (see
+     * `permissionReplayFrames`). Every ACP ask is a ledger entry, so this is the
+     * whole live set.
      */
     pendingPermissionViews(): PendingPermissionView[];
     /**
@@ -1689,11 +1600,6 @@ export declare class BridgeManager {
     private readonly chatAgentIntent;
     /** Drop every chat-keyed record pointing at one host session (close/stop paths). */
     private forgetDshSession;
-    /**
-     * Latest native-approval requester. Held as a field (read through a thunk by
-     * each bridge) so a requester wired after bridges were built still applies.
-     */
-    private approvalRequester?;
     private sessionWorkspaceResolver?;
     private acpModeResolver?;
     /** Cached `chatSessionAcpMode` answers, keyed by DSH chat session id. */

package/lib/types/client/panel.d.ts

@@ -2,11 +2,11 @@
  * React surface for ACP: the settings configuration section.
  *
  * Scope is deliberately narrow — this is a CONFIGURATION surface. Runtime
- * interaction lives in the conversation: permission asks are answered in the
- * chat composer through the host approval chain. The ledger card answers
- * whatever did NOT reach the conversation — a host without the chain, a
- * session with no chat identity behind it, or an ask whose native route
- * degraded to unavailable (see `permissionLedgerCard`).
+ * interaction lives in the conversation: every permission ask with a chat
+ * identity is answered on a card above that conversation's composer
+ * (`permission-dock.tsx`). The ledger card here is the cross-session mirror —
+ * asks whose conversation is not open, or which have no chat identity at all —
+ * and is where those are answered (see `permissionLedgerCard`).
  *
  * Each configured agent is one compact row (status + current model + badges)
  * that expands into the full connection form and model catalog. The row stays
@@ -30,22 +30,15 @@ export declare function payloadEquals(payload: AgentSavePayload, current: AcpAge
 /**
  * The settings panel's permission-ledger rule.
  *
- * A pending ask ALWAYS gets an answerable card here, whatever `approvalRouted`
- * says. That flag reports that the host HAS an approval service — it does not
- * promise THIS ask reached the conversation. An ask lands in `ui.permissions`
- * only on the ledger path (`AgentBridge.handlePermissionRequest` broadcasts
- * `permission/request` there and nowhere else), so a pending entry is by
- * definition a question the conversation is not showing. The previous rule
- * (`approvalRouted` → a read-only count, no buttons) hid the only answer
- * entry exactly when the native route had degraded to unavailable, and the
- * ask then hung until its timeout.
- *
- * `fellBackFromConversation` is the case the card has to explain: the host
- * can route asks, and this one still did not make it.
+ * Pending asks are shown in the conversation card while that conversation is
+ * open; this card is the cross-session mirror for the ones it cannot show —
+ * asks belonging to another conversation, and `/acp` RPC-only asks with no
+ * chat identity at all. It therefore appears whenever ANY ask is pending: a
+ * pending entry with no conversation card would otherwise have no answer
+ * surface anywhere.
  */
-export declare function permissionLedgerCard(ui: Pick<UiState, 'approvalRouted' | 'permissions'>): {
+export declare function permissionLedgerCard(ui: Pick<UiState, 'permissions'>): {
     visible: boolean;
-    fellBackFromConversation: boolean;
 };
 /**
  * The shortest REAL wait — the first rung above 不等待.

package/lib/types/client/permission-dock.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Pending ACP permission asks for the staged DSH conversation, rendered as
+ * composer-width entries above the composer card (`conversation.input.dock`).
+ * The slot itself spans the conversation column; the dock mirrors the host's
+ * InputBar width formula so the cards line up with the input box.
+ *
+ * The host broadcasts every ask as `permission/request`, carrying the DSH chat
+ * session id when the ask belongs to a conversation. This dock is the primary
+ * answer surface: it renders exactly the asks whose `dshSessionId` is the
+ * conversation it was mounted for, and nothing otherwise. There is no
+ * ACP-mode gate — the frame set itself is the gate, so an ordinary
+ * conversation shows this card if and only if it actually has an ask.
+ *
+ * The ask's description and options are the agent's own: buttons appear in the
+ * agent's order with the agent's names (including "Always Allow"), and
+ * `kind` is not rendered. A separate cancel button answers with no option,
+ * which the host forwards as `cancelled`. No Enter/Escape handlers: the
+ * composer owns its keyboard, and these are ordinary focusable buttons.
+ *
+ * Multiple asks stack in ARRIVAL order, oldest first: the question ignored
+ * longest stays at the top. The list is capped in height by CSS and scrolls.
+ * Asks without a chat identity never appear here — they stay in the
+ * settings-panel ledger, the cross-session mirror.
+ */
+import type { AcpStore } from './store.ts';
+export interface PermissionDockProps {
+    /** Injected face: the store plus the chat session id this dock belongs to. */
+    acp: AcpStore;
+    sessionId: string;
+}
+export declare function PermissionDock({ acp, sessionId }: PermissionDockProps): import("react").JSX.Element | null;

package/lib/types/client/store.d.ts

@@ -84,16 +84,49 @@ export type Block = {
     tone: 'info' | 'error';
     text: string;
 };
+/**
+ * One permission ask waiting for a human. Every field is copied VERBATIM from
+ * the host's `permission/request` frame: the host owns what the ask is called
+ * (`toolName` / `reason`), which options the agent offered (order included),
+ * and whether the ask carries a deadline. The browser does not derive a title
+ * from `toolCall` and does not second-guess the agent's option labels.
+ */
 export interface PendingPermission {
     requestId: string;
+    /** ACP session id. */
     sessionId: string;
-    title: string;
+    /** DSH chat session id; absent for `/acp` RPC-only sessions (settings-only ask). */
+    dshSessionId?: string;
+    toolName: string;
+    reason?: string;
     options: Array<{
         optionId: string;
         name: string;
         kind: string;
     }>;
+    timeoutMode: PermissionTimeoutMode;
+    /** Epoch ms; absent in `wait` mode. */
+    deadlineAt?: number;
 }
+/** Returned by {@link deadlineRemainingLabel} once the deadline has passed. */
+export declare const PERMISSION_DEADLINE_EXPIRED = "expired";
+/**
+ * The asks that belong to one DSH chat conversation. An ask without a
+ * `dshSessionId` belongs to no conversation (an `/acp` RPC-only session), so it
+ * is deliberately absent from every conversation's dock and stays in the
+ * settings-panel ledger.
+ */
+export declare function permissionsForSession(permissions: readonly PendingPermission[], dshSessionId: string): PendingPermission[];
+/**
+ * Compact countdown for one ask, or `undefined` when there is nothing to count
+ * down (`wait` mode, or a frame without a deadline). Pure so the formatting is
+ * testable without a clock: the dock passes `Date.now()` on its tick.
+ *
+ * Past the deadline the answer is {@link PERMISSION_DEADLINE_EXPIRED} rather
+ * than a negative number — the host has already armed the expiry, and a card
+ * counting backwards would claim a deadline that no longer exists.
+ */
+export declare function deadlineRemainingLabel(deadlineAt: number | undefined, now: number, mode: PermissionTimeoutMode): string | undefined;
 /**
  * One observed ACP transcript, keyed by ACP session id. This is the ACP view
  * tab's data source: the native chat plane can only render text/reasoning
@@ -164,17 +197,6 @@ export interface UiState {
      * that never answers, …) reads as a dead button.
      */
     probeErrors: Record<string, string>;
-    /**
-     * Host reports that it HAS the native approval chain (permission asks are
-     * answered in the chat composer). This is a capability report, not a
-     * per-ask promise: an individual ask still falls back to the settings-panel
-     * ledger when the service is unavailable this time, or when the session has
-     * no chat identity behind it (`AgentBridge.askNativeApproval`). The panel
-     * therefore answers ANY pending ask, whatever this flag says — see
-     * `permissionLedgerCard` in panel.tsx. False on an older host or when the
-     * approval service is missing, in which case the ledger is the only path.
-     */
-    approvalRouted: boolean;
     /**
      * ACP agent sessions backing the chat session the composer control sits in.
      * Only meaningful together with {@link chatSessionsFor}: the control reads it
@@ -556,6 +578,14 @@ export declare class AcpStore {
     /** Mirror the running flag onto a transcript the ACP view is showing. */
     private markWatchedRunning;
     setConfigOption(configId: string, value: string): Promise<void>;
+    /**
+     * Answer one ask (`optionId` absent = cancel it). A failure is reported
+     * through the store's notice — the settings panel renders that — AND
+     * rethrown, so the conversation dock can pin the message next to the card
+     * that failed instead of leaving it on a settings page the user may not
+     * have open. Callers that cannot show it (the settings panel) swallow it
+     * after the notice.
+     */
     respondPermission(requestId: string, optionId?: string): Promise<void>;
     stopAgent(agentId: string): Promise<void>;
     /**